Should I be worried about InvalidAuthenticityToken errors? I’m pretty
sure this isn’t someone trying to hack us, but I suspect may be some
config error on our part.
We have 2 servers, each with multiple mongrels and Apache load-balancing
between them.
On the same lines, should I expect an authenticity token to remain
constant for the life of a session? I’ve analyzed my logs and I am
/definitely/ seeing instances where it looks like the authenticity token
is changing within a session (infrequently, though).
When it does change, it seems to be okay, though–since the response to
the client has the new authenticity token, then the form submit has the
new one and everything is okay.
But I do have cases where the server rejects the authenticity token…
any ideas why might this be happening or what I can look at to try and
debug?
Thanks,
dwh